Sql injection

An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. The code parameter in the getAssets.jsp page is vulnerable to unauthenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2020-27239

CVE-2020-27239 affects OpenClinic GA 5.173.3 where the assetStatus parameter in getAssets.jsp is vulnerable to unauthenticated SQL injection. The issue arises from query construction that directly embeds input values (e.g., assetStatus) into SQL, enabling attackers to manipulate the query via cra...

CVE-2020-27239

An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. The assetStatus parameter in the getAssets.jsp page is vulnerable to unauthenticated SQL injection An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2020-27238

The CVE-2020-27238 family concerns OpenClinic GA 5.173.3, where the getAssets.jsp page is vulnerable to SQL injection across multiple input parameters. Connected sources enumerate specific injectable fields including code, nomenclature, compnomenclature, description, serviceuid, serialnumber, ass...

CVE-2020-27237

An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. The code parameter in the The nomenclature parameter in the getAssets.jsp page is vulnerable to unauthenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this...

CVE-2020-27237

CVE-2020-27237 affects OpenClinic GA 5.173.3. The vulnerability is an SQL injection in the getAssets.jsp page, allowing unauthenticated injection via multiple input parameters (e.g., supplierUID, serviceuid, nomenclature, description, code, etc.) as shown in the connected advisories. Multiple sou...

PT-2021-11333

Name of the Vulnerable Software and Affected Versions: OpenClinic GA version 5.173.3 Description: An exploitable SQL injection issue exists in the getAssets.jsp page. The code parameter and the nomenclature parameter in this page are vulnerable to unauthenticated SQL injection. An attacker can...

PT-2021-11335

Name of the Vulnerable Software and Affected Versions: OpenClinic GA version 5.173.3 Description: An exploitable SQL injection issue exists in the getAssets.jsp page. The assetStatus parameter in this page is vulnerable to unauthenticated SQL injection. An attacker can trigger this issue by makin...

PT-2021-11334

Name of the Vulnerable Software and Affected Versions: OpenClinic GA version 5.173.3 Description: An exploitable SQL injection issue exists in the getAssets.jsp page. The code parameter in this page is vulnerable to unauthenticated SQL injection. An attacker can trigger this issue by making an...

CVE-2020-27235

An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the description parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2020-27235

An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the description parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2020-27236

An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the compnomenclature parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2020-27233

An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the supplierUID parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2020-27233

An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the supplierUID parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2020-27234

An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the serviceUID parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability...

Sql injection

An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the serviceUID parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability...

Design/Logic Flaw

An incorrect default permissions vulnerability exists in the installation functionality of OpenClinic GA 5.173.3. Overwriting the binary can result in privilege escalation. An attacker can replace a file to exploit this vulnerability...

Sql injection

An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the supplierUID parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability...

Sql injection

An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the description parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2020-27228

OpenClinic GA 5.173.3 is affected by an installation-time privilege-escalation vulnerability (CVE-2020-27228). The underlying issue is an incorrect default permissions setup that permits modification of the OpenClinic MySQL service binary (example path: c:\projects\openclinic\mysql5\bin\mysqld.ex...